On September 15, 2026, all Cloud Composer 1 versions and versions 2.0.x of Cloud Composer 2 will reach their planned end of life. You will not be able to use environments with these versions. We recommend planning migration to Cloud Composer 3. Cloud Composer 2 versions 2.1.x and later are still supported and are not impacted by this change.
This page provides troubleshooting steps and information for common Airflow
web server issues.
The Airflow web server is an Airflow component that provides a user interface
for managing Airflow DAGs and tasks. This page describes troubleshooting steps
for various issues with accessing the Airflow web server of your environment or
for web server-related warnings visible in Airflow logs.
Can't access Airflow UI when network access controls are enabled
Symptom: After web server access controls are configured, it's not possible
to access Airflow UI. Usually, the error code displayed in this situation is
403.
Information about the issue: Cloud Composer supports
web server network access controls,
which lets you specify IP ranges that are allowed to connect to the web server.
Problems with accessing Airflow UI usually result in error 403. To check if the
error is related to web server network access controls, do the following:
In the list of environments, click the name of your environment.
The Environment details page opens.
Go to the Environment configuration tab.
Check if the Web server access control item is set to
All IP addresses have access (default).
If a value different than All IP addresses have access (default) is
configured, then network access control is enabled and the visibility
of the Airflow UI is limited to the provided IPv4 and IPv6 address
ranges. In this case, the problem might be related to web server network
access controls.
In most cases, the cause of the issue is the mismatch between the intended IP
that you specified and the IP that is actually resolved to connect to the
Airflow UI. To troubleshoot the problem, do the following:
In the list of environments, click the name of your environment.
The Environment details page opens.
Go to the Environment configuration tab.
Find the Web server access control item and click Edit.
In the Web server network access control dialog, select
Allow access from all IP addresses.
Access the Airflow UI multiple times and verify that it works without any
issues:
If you don't experience problems, continue to the next step.
If you experience a problem at this point, it means that the issue might
be related to your IAM permissions configuration. For
more information about the IAM permissions for
Cloud Composer, see Access control.
In the Web server network access control dialog, select
Allow access only from specific IP addresses.
Add the 0.0.0.0/0 IP range, then access the Airflow UI multiple times and
verify that it works without issues:
If you don't experience problems, then the IP that you're connecting
with is an IPv4 address.
If you experience a problem at this point, it means the IP you're
connecting with is an IPv6 address.
Delete the 0.0.0.0/0 IP range, and add the ::/0 IP range.
If you don't experience problems, then the IP that you're connecting
with is an IPv6 address.
If you experience a problem at this point, it means the IP you're
connecting with is an IPv4 address.
Now you determined if your resolved address is IPv4 or IPv6.
Depending on the address type, narrow down the ::/0 or 0.0.0.0/0 ranges
to more specific ones, to verify the broadest range when the access stops
working:
You can start with the wide subnet mask (such as 192.0.2.0/8) that
includes the address that you assume to be your IP address.
To determine your IP address, you can use a third-party service that
provides your external IP address when you visit its page. You can
search for such services by the "what is my IP address" search query).
Configuration values aren't displayed on the configuration page
Some Airflow configuration parameters of Airflow are hidden on the
configuration page to prevent access to potentially sensitive information. For
example, credentials to access the Airflow database are not displayed.
To display hidden fields, override the following Airflow
configuration option. We recommend to revert the changes after you obtain the
required values.
Section
Key
Value
Notes
webserver
expose_config
True
The default value is non-sensitive-only. Set to False to hide
all configuration parameters.
DAG crashes the Airflow web server or causes it to return a '502 gateway timeout' error
Web server failures can occur for several different reasons. Check
the airflow-webserver logs in
Cloud Logging to determine the cause of the
502 gateway timeout error.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-05 UTC."],[[["\u003cp\u003eThis page offers guidance on troubleshooting common issues with the Airflow web server, which provides a user interface for managing Airflow DAGs and tasks.\u003c/p\u003e\n"],["\u003cp\u003eThe primary focus is on resolving access problems, particularly error 403, when web server network access controls are enabled in Cloud Composer 2.\u003c/p\u003e\n"],["\u003cp\u003eTroubleshooting involves verifying if network access control is enabled and then pinpointing the discrepancy between the intended IP and the actual IP used to connect to the Airflow UI.\u003c/p\u003e\n"],["\u003cp\u003eThe document outlines a step-by-step process to identify whether the resolved IP address is IPv4 or IPv6, then narrowing down IP ranges for specific access permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe content is applicable to Cloud Composer 2 only and is not yet revised for Cloud Composer 3.\u003c/p\u003e\n"]]],[],null,["**Cloud Composer 3** \\| [Cloud Composer 2](/composer/docs/composer-2/troubleshooting-web-server \"View this page for Cloud Composer 2\") \\| [Cloud Composer 1](/composer/docs/composer-1/troubleshooting-web-server \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n| **Note:** This page is **not yet revised for Cloud Composer 3** and displays content for Cloud Composer 2.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides troubleshooting steps and information for common Airflow\nweb server issues.\n\nThe Airflow web server is an Airflow component that provides a user interface\nfor managing Airflow DAGs and tasks. This page describes troubleshooting steps\nfor various issues with accessing the Airflow web server of your environment or\nfor web server-related warnings visible in Airflow logs.\n\nCan't access Airflow UI when network access controls are enabled\n\n**Symptom**: After web server access controls are configured, it's not possible\nto access Airflow UI. Usually, the error code displayed in this situation is\n403.\n\n**Information about the issue** : Cloud Composer supports\n[web server network access controls](/composer/docs/composer-2/access-airflow-web-interface#network-access-controls),\nwhich lets you specify IP ranges that are allowed to connect to the web server.\n\nProblems with accessing Airflow UI usually result in error 403. To check if the\nerror is related to web server network access controls, do the following:\n\n1. In the list of environments, click the name of your environment. The **Environment details** page opens.\n2. Go to the **Environment configuration** tab.\n3. Check if the **Web server access control** item is set to **All IP addresses have access (default)**.\n4. If a value different than **All IP addresses have access (default)** is configured, then network access control is enabled and the visibility of the Airflow UI is limited to the provided IPv4 and IPv6 address ranges. In this case, the problem might be related to web server network access controls.\n\nIn most cases, the cause of the issue is the mismatch between the intended IP\nthat you specified and the IP that is actually resolved to connect to the\nAirflow UI. To troubleshoot the problem, do the following:\n\n1. In the list of environments, click the name of your environment.\n The **Environment details** page opens.\n\n2. Go to the **Environment configuration** tab.\n\n3. Find the **Web server access control** item and click **Edit**.\n\n4. In the **Web server network access control** dialog, select\n **Allow access from all IP addresses**.\n\n5. Access the Airflow UI multiple times and verify that it works without any\n issues:\n\n - If you don't experience problems, continue to the next step.\n\n - If you experience a problem at this point, it means that the issue might\n be related to your IAM permissions configuration. For\n more information about the IAM permissions for\n Cloud Composer, see [Access control](/composer/docs/composer-2/access-control).\n\n6. In the **Web server network access control** dialog, select\n **Allow access only from specific IP addresses**.\n\n7. Add the `0.0.0.0/0` IP range, then access the Airflow UI multiple times and\n verify that it works without issues:\n\n - If you don't experience problems, then the IP that you're connecting\n with is an IPv4 address.\n\n - If you experience a problem at this point, it means the IP you're\n connecting with is an IPv6 address.\n\n8. Delete the `0.0.0.0/0` IP range, and add the `::/0` IP range.\n\n - If you don't experience problems, then the IP that you're connecting\n with is an IPv6 address.\n\n - If you experience a problem at this point, it means the IP you're\n connecting with is an IPv4 address.\n\n9. Now you determined if your resolved address is IPv4 or IPv6.\n\n10. Depending on the address type, narrow down the `::/0` or `0.0.0.0/0` ranges\n to more specific ones, to verify the broadest range when the access stops\n working:\n\n - You can start with the wide subnet mask (such as `192.0.2.0/8`) that\n includes the address that you assume to be your IP address.\n\n - To determine your IP address, you can use a third-party service that\n provides your external IP address when you visit its page. You can\n search for such services by the \"what is my IP address\" search query).\n\nConfiguration values aren't displayed on the configuration page\n\nSome Airflow configuration parameters of Airflow are hidden on the\nconfiguration page to prevent access to potentially sensitive information. For\nexample, credentials to access the Airflow database are not displayed.\n| **Warning:** If you configure Airflow to display these parameters, then\n| **any Airflow user with `Admin` and `Op` permission will be able to access this\n| information.**\n| By default, Airflow assigns the `Op` role to new Airflow users.\n|\n| To prevent Airflow users with the `Op` role from accessing the configuration page:\n|\n| 1. Go to the **Security** \\\u003e **List Roles** configuration page in the Airflow UI.\n| 2. Revoke the **can read Configurations** and **menu access on Configurations** permissions from the `Op` role.\n\nTo display hidden fields, [override](/composer/docs/composer-2/override-airflow-configurations) the following Airflow\nconfiguration option. We recommend to revert the changes after you obtain the\nrequired values.\n\n| Section | Key | Value | Notes |\n|-------------|-----------------|--------|-------------------------------------------------------------------------------------------------|\n| `webserver` | `expose_config` | `True` | The default value is `non-sensitive-only`. Set to `False` to hide all configuration parameters. |\n\nDAG crashes the Airflow web server or causes it to return a '502 gateway timeout' error\n\nWeb server failures can occur for several different reasons. Check\nthe **airflow-webserver** logs in\n[Cloud Logging](/composer/docs/composer-2/view-logs#streaming) to determine the cause of the\n`502 gateway timeout` error.\n\nWhat's next\n\n- [Access Airflow UI](/composer/docs/composer-2/access-airflow-web-interface)\n- [Access control](/composer/docs/composer-2/access-control)"]]
